Washington Employee Monitoring Laws: Biometric Privacy, Social Media, and Surveillance (2026)

Washington employers who monitor company email, phone lines, and computer systems generally start from the same federal baseline as employers nationwide, but Washington layers on more state-specific rules than most states in this series. A social media privacy law, a felony-level voyeurism statute, and, most notably, Washington's own biometric privacy law, RCW 19.375, create a compliance picture that differs in real ways from neighboring states, and one that several national compliance blogs describe inaccurately.

This article provides general legal information about Washington employee monitoring law as of July 9, 2026. It is not legal advice and does not create an attorney-client relationship. Consult a Washington-licensed attorney about your specific situation.

Scope: This article covers Washington law on an employer's authority to monitor employees, access personal social media, and conduct workplace video, GPS, and biometric monitoring. It does not re-derive Washington's general all-party consent recording rules (see our Washington recording laws guide) or GPS law generally outside employment (see our Washington GPS tracking laws guide).

The Federal Baseline: the "Ordinary Course of Business" Exception

Washington's starting point for any workplace monitoring question is federal law. Title I of the Electronic Communications Privacy Act bars intentionally intercepting wire, oral, or electronic communications without consent (18 U.S.C. § 2511), but 18 U.S.C. section 2510(5)(a) excludes employer-furnished communications equipment from the Act's definition of a covered device when that equipment is used in the ordinary course of business, a business-extension exemption letting employers who own the phone, email, and computer systems their staff use monitor communications on those systems without triggering the Wiretap Act's interception prohibition.

The leading case is Watkins v. L.M. Berry & Co., 704 F.2d 577 (11th Cir. 1983): once a monitored call is identified as personal, the ordinary-course exception generally ends and continued listening can create liability. That federal floor governs reviewing stored company email or business calls in Washington like anywhere else. It does not resolve real-time listening or recording, which Washington's own stricter consent statute governs, addressed later in this article.

Does Washington Require Notice Before Electronic Monitoring? The Pending HB 1672

Connecticut, Delaware, New York, and Maine require employers to give notice before monitoring phone, email, or internet use. Washington has not enacted a comparable statute as of July 9, 2026, so employers monitoring their own systems today can generally rely on the federal ordinary-course exception, without a state-mandated notice step.

That could change. House Bill 1672 would require advance written notice before monitoring begins, describing its form, purpose, data collected, and retention period. As reported by the House Labor & Workplace Standards Committee, it would also bar monitoring during off-duty hours or in private spaces, restrict compelled monitoring software on personal devices, and prohibit facial, gait, or emotion recognition technology, enforced by the Department of Labor and Industries with escalating civil penalties up to $10,000 per violation. The Bill Report does not describe a private right of action.

HB 1672 is not law. Introduced January 28, 2025, it cleared committee as a first substitute but did not pass the House before the 2025 session ended. Reintroduced by resolution on January 12, 2026, it remains in House Appropriations as of July 9, 2026. Some compliance vendor sites wrongly describe it as already-effective with a mid-2026 effective date and an employee lawsuit right; it is a pending bill, not a statute. A narrower related bill, HB 2144, on AI-tool notice for performance evaluations, is also still pending.

Washington's Social Media Privacy Law for Employees

RCW 49.44.200 prohibits an employer from requiring an employee or applicant to disclose a personal social media password, requiring account access in the employer's presence, compelling them to add a supervisor as a contact, or requiring a privacy-setting change, and bars discharging, disciplining, or refusing to hire someone who declines. Exceptions let an employer request shared content when investigating specific misconduct information, an unauthorized transfer of proprietary information, or regulatory compliance, so long as it does not demand login credentials directly; the law does not limit authority over employer-provided accounts. It applies to any Washington employer with one or more employees, including state and local government.

RCW 49.44.205 lets an employee or applicant harmed by a violation recover injunctive relief, actual damages, a $500 statutory penalty, and attorney fees and costs. A court that finds the lawsuit frivolous can award the employer its own fees under RCW 4.84.185, a general frivolous-litigation fee-shifting statute enacted in 1983 and last amended in 1991, well before the 2013 social-media-privacy law it is invoked alongside here.

Video and Audio Surveillance in Washington Workplaces

Washington addresses covert cameras through its criminal voyeurism statute, RCW 9A.44.115, rather than a labor law. It protects any place where a person has a reasonable expectation of privacy, including a place where someone could reasonably disrobe without being photographed, language that covers restrooms, locker rooms, and changing areas. Voyeurism in the first degree, a class C felony, requires that the person act "for the purpose of arousing or gratifying the sexual desire of any person," and that purpose element opens RCW 9A.44.115(2)(a), so it governs both of the prongs that follow it: knowingly viewing, photographing, or filming someone without consent in such a place, and knowingly viewing, photographing, or filming another person's intimate areas without consent. Filming intimate areas with intent to distribute is voyeurism in the second degree, a gross misdemeanor, not a registerable sex offense. Courts may order the images destroyed.

The statute's only express exception is narrow and does not reach private employers: Department of Corrections or local jail personnel viewing, photographing, or filming for security purposes or during an investigation of alleged misconduct by a person in custody. A private employer has no comparable shelter, but the sexual-purpose element still has to be proven, so a restroom or locker-room camera installed purely for loss prevention, with no sexual purpose behind it, does not on the statute's face establish first-degree voyeurism. That is not a green light. Such a camera still supports a civil invasion-of-privacy claim, and if it captures audio it raises separate exposure under RCW 9.73. Cameras in ordinary work areas raise no comparable problem.

Audio is a separate question. Washington is an all-party consent state under RCW 9.73.030, so recording a private conversation generally requires everyone's consent. See our Washington workplace recording guide for that framework; the interaction with employer monitoring authority is addressed later in this article.

GPS and Vehicle Tracking of Washington Employees

Washington has no dedicated employer vehicle-tracking notice statute like New Jersey's N.J. Stat. section 34:6B-22, and recent legislative sessions show no comparable bill advancing. The relevant general law is the stalking statute, RCW 9A.46.110(1)(a)(iv), which makes it a gross misdemeanor, with felony enhancements for prior offenses or an armed offender, to knowingly and without consent install or monitor an electronic tracking device on another person.

Two exceptions matter, and they differ in scope. RCW 9A.46.110(4)(e) exempts an employer-owned device provided for organizational use, but only when its tracking function is limited to recovering lost or stolen items. RCW 9A.46.110(4)(f) is broader: it exempts the owner of fleet vehicles when tracking those vehicles, with no such limitation, so an employer tracking its own company vehicles is generally exempt without notice.

Washington has legislated in adjacent territory worth flagging even though it is not GPS-specific: Governor Bob Ferguson signed HB 2303 on March 11, 2026, effective June 11, 2026, now codified at RCW 49.44.235, barring an employer from requesting, requiring, or coercing an employee or applicant to have a microchip implanted beneath the skin, aside from implants used to diagnose, monitor, treat, or prevent a health condition. The section gives an aggrieved employee a civil action for injunctive relief, actual and punitive damages, and attorney fees. HB 1672, described above, would also fold location tracking into its broader notice regime if enacted. For general tracking-device law outside employment, see our Washington GPS tracking laws guide.

Biometric Monitoring: Washington's Biometric Identifiers Law, RCW 19.375

This is where Washington genuinely stands apart. Illinois' Biometric Information Privacy Act, 740 ILCS 14, requires written consent before any collection of a biometric identifier and creates a private right of action that has produced multimillion-dollar settlements against employers and timeclock vendors. Washington's Biometric Identifiers chapter, RCW 19.375, enacted in 2017, works quite differently.

RCW 19.375.010 defines "biometric identifier" as data generated by automatic measurement of biological characteristics, such as a fingerprint, voiceprint, or eye retinas and irises, used to identify a specific person. It expressly excludes a photograph, video, or audio recording (and data generated from one), plus health data already covered by HIPAA.

The operative duty, RCW 19.375.020, bars enrolling a biometric identifier in a database for a commercial purpose without first providing notice, obtaining consent, or offering a mechanism to prevent that use. "Enroll" means capturing the identifier, converting it to a reference template, and storing it in a matching database.

The nuance most compliance blogs miss is how narrowly RCW 19.375.010 defines "commercial purpose" itself: furtherance of the sale or disclosure to a third party of a biometric identifier for marketing goods or services unrelated to the transaction in which it was first collected, expressly excluding a security or law enforcement purpose. Read literally, a standard timeclock that captures a fingerprint or face template purely to track attendance, and never sells or discloses that data for marketing, does not obviously trigger the notice-and-consent duty at all, a narrower reading than Illinois' BIPA, where consent attaches to collection generally.

That reading carries real caveats. No Washington court has tested how far "commercial purpose" reaches in employment, and routing timeclock data through a third-party vendor's cloud platform can shift the analysis toward disclosure provisions that apply regardless of marketing intent. RCW 19.375.040 excludes financial institutions under Gramm-Leach-Bliley, HIPAA data, and law enforcement authority, but has no express carve-out, either direction, for employment or time-and-attendance uses; the commercial-purpose gate in the definitions, not a topic-based exclusion, is what actually limits the statute here.

Enforcement is the other major divergence from Illinois. RCW 19.375.030 makes a violation an unfair or deceptive act under the Consumer Protection Act, RCW 19.86, but enforcement runs solely through the Washington Attorney General. There is no private right of action; an employee cannot personally sue over a biometric time clock the way an Illinois employee could under BIPA, though a complaint can be filed with the Attorney General's office.

Washington's My Health My Data Act, RCW 19.373, is worth checking separately since it is the state's other major recent privacy statute, but it does not extend to employment. RCW 19.373.010 defines "consumer" to act "only in an individual or household context" and states plainly that "consumer" does not include an individual acting in an employment context. That exclusion means MHMDA's opt-in consent, its consumer health data protections, and its private right of action do not reach data a Washington employer collects about its own employees, including through a wellness program or biometric time clock. There is no meaningful MHMDA connection to employee biometric monitoring; RCW 19.375, narrower and AG-only, remains the only state biometric statute that could reach Washington workplace biometric data at all. See our Washington biometric privacy guide and guide to the My Health My Data Act for how these laws work outside employment.

All-Party Consent and the Ordinary Course of Business Exception

Washington's consent law creates a more interesting interaction with the federal ordinary-course-of-business exception than most states produce. RCW 9.73.030 requires the consent of all participants before a private communication can be recorded or intercepted, and unlike the federal Wiretap Act, it has no business-extension exception. Washington courts read its interception language broadly, reaching real-time listening, not just recording: in State v. Christensen, 153 Wn.2d 186, 102 P.3d 789 (2004), the Washington Supreme Court held that a person who used a cordless phone's speakerphone to listen to another private conversation violated the Privacy Act even without recording, and that a cordless call carries no reduced expectation of privacy.

The practical consequence is that the federal ordinary-course exception, which lets an employer as system owner listen to business calls under federal law, does not by itself satisfy Washington's stricter all-party consent requirement for a live call. An employer generally needs Washington's own consent mechanism. RCW 9.73.030(3) supplies it: consent is deemed given once a party announces, in a reasonably effective manner, that a call is being recorded or monitored, provided the announcement is itself recorded; a person who stays on the line afterward is treated as consenting. That familiar "this call may be monitored" notice, not the federal exception alone, is what Washington employers actually rely on. See our Washington recording laws guide for the full consent framework.

What Washington Employees Can Do About Monitoring Concerns

A demand for a social media password supports a civil claim under RCW 49.44.205 for actual damages, a $500 penalty, and attorney fees. A camera in a restroom or locker room supports a civil invasion-of-privacy claim, and a law enforcement report under the voyeurism statute where the statute's sexual-purpose element is present. A biometric time clock enrolled for a commercial purpose without notice can be reported to the Attorney General's Consumer Protection Division, though it does not support an individual lawsuit. A secretly monitored call without proper notice can support a criminal complaint and a civil claim under the Privacy Act, while monitoring tied to a protected characteristic or concerted activity may fall under the Washington Human Rights Commission or the National Labor Relations Board instead.

Washington's rules are split across criminal law, a narrow social media statute, an even narrower biometric statute, and a pending general notice bill, so an employee with a specific fact pattern should keep records, save any written policy, and consult a Washington-licensed employment attorney. For the broader picture, see our Employee Monitoring Laws by State hub and our general US recording laws guide.

Disclaimer

This article provides general legal information about Washington employee monitoring law as of July 9, 2026. It is not a substitute for individualized legal advice. Washington's monitoring rules are split across several distinct statutes, a pending bill, and federal law, and outcomes depend on specific facts. Readers should consult an attorney licensed in Washington for advice about a particular situation.

Related articles

• Employee Monitoring Laws by State
• Washington Recording Laws
• Washington Workplace Recording Laws
• Washington GPS Tracking Laws
• Washington Biometric Privacy Laws
• Washington Data Privacy Laws
• What Is the Washington My Health My Data Act?
• US Recording Laws by State

---

Last updated: July 9, 2026. Statutes cited reflect their in-force version as of that date.

More Washington Laws

• Washington AI Meeting Recording Laws
• Washington At-Will Employment Laws
• Washington Data Privacy Laws
• Washington GPS Tracking Laws
• Washington Recording Laws
• Washington Whistleblower Laws

Frequently Asked Questions

Does Washington require my employer to notify me before monitoring my email or internet use?

Not yet. Washington has no enacted electronic-monitoring notice statute like Connecticut, Delaware, New York, or Maine. House Bill 1672 would create one, but as of July 9, 2026 it remains pending in House Appropriations, not a law.

Can my Washington employer ask for my Instagram or Facebook password?

No, not for a personal account. RCW 49.44.200 prohibits requiring a personal social media password, except in narrow misconduct-investigation or regulatory-compliance circumstances where credentials still cannot be demanded directly.

Can my Washington employer require a fingerprint or face scan for the time clock?

Possibly, without extra notice. RCW 19.375's notice-and-consent duty applies only when a biometric identifier is enrolled 'for a commercial purpose,' defined narrowly as sale or disclosure to a third party for marketing. A purely internal timeclock may fall outside that trigger, and the law is enforced only by the Attorney General, not by employee lawsuit.

Does Washington's My Health My Data Act protect my biometric or health data at work?

No. RCW 19.373.010 defines 'consumer' to exclude an individual acting in an employment context, so the Act's rights do not extend to data an employer collects about its own employees.

Can my employer put a camera in a Washington workplace restroom or locker room?

Practically, no. RCW 9A.44.115 makes first-degree voyeurism a class C felony only when the viewing, photographing, or filming is done 'for the purpose of arousing or gratifying the sexual desire of any person,' so a camera installed purely for loss prevention would not on the statute's face meet that element. It still exposes the employer to a civil invasion-of-privacy claim, and to separate liability under RCW 9.73 if it records audio. The statute's only exception covers corrections and jail personnel, not private employers.

Can my Washington employer GPS track a company vehicle I drive?

Generally yes. RCW 9A.46.110(4)(f) exempts the owner of fleet vehicles from the general electronic-tracking-device prohibition, with no notice requirement, when tracking a vehicle it owns.

Can my Washington employer secretly record my phone calls?

No, generally not without consent. Washington is an all-party consent state under RCW 9.73.030 with no ordinary-course-of-business exception. Employers typically rely on the statute's consent-by-announcement mechanism instead, such as a recorded notice that a call may be monitored.

Can my Washington employer require me to have a tracking microchip implanted?

No. RCW 49.44.235, effective June 11, 2026, bars employers from requesting, requiring, or coercing a microchip implant beneath an employee's or applicant's skin, aside from implants used to diagnose, monitor, treat, or prevent a health condition. An aggrieved employee may sue for injunctive relief, actual and punitive damages, and attorney fees.